docs: the Silverblue kiosk client, installed and checked over SSH

A wall display is now a target client: Fedora Silverblue running GNOME
Kiosk, auto-logged in as kiosk, showing /watch fullscreen in Firefox.
docs/kiosk-silverblue/ carries the idempotent installer, a read-only
checker and a probe that measures what the browser actually renders, so
a second client is a copy-paste and nothing about it needs a keyboard.

The runbook records what the upstream tutorial leaves out: gsettings
only commits from inside the session (gnome-kiosk sets DCONF_PROFILE,
so a system dconf db is never read at all), window-config.ini wins by
being found first and therefore silently loses the shipped notification
rules, AccountsService caches Session= until its daemon restarts, and
/watch survives a bare LAN IP while /mirror cannot.

Verified on the reference client: cold boot back to a subscribed wall in
under 60s, viewport == window == screen at 3840x2160, and the sharer's
own peer connection to it reports connected.

LLM-Generated: true

docs/kiosk-silverblue/window-config.ini

@@ -0,0 +1,34 @@
+# /usr/local/share/gnome-kiosk/window-config.ini — mirror kiosk window policy.
+#
+# gnome-kiosk searches $XDG_CONFIG_HOME/gnome-kiosk/ first, then $XDG_DATA_DIRS
+# in order (/var/lib/flatpak/exports/share, /usr/local/share, /usr/share), and
+# uses the FIRST file it finds. /usr/local/share is therefore the right place
+# on Silverblue: it is mutable (it is /var/usrlocal) and it wins over the
+# shipped /usr/share/gnome-kiosk/window-config.ini without touching /usr.
+#
+# Because that shipped file is then *not* read, anything it defines has to be
+# repeated here or it is lost. The [notifications] section below is copied
+# verbatim from gnome-kiosk-50.1's shipped file for that reason.
+
+# Firefox is the kiosk application: force it fullscreen even if it comes up
+# windowed (e.g. after a resume, or if --kiosk is ever dropped).
+[mirror-browser]
+match-class=org.mozilla.*
+set-fullscreen=true
+
+# Copied from the shipped window-config.ini — kiosk notifications stay a
+# small overlay in the top-left instead of stealing the whole screen.
+[notifications]
+match-tag=gnome-kiosk-notification
+set-x=0
+set-y=0
+set-fullscreen=false
+set-above=true
+
+# Multi-monitor: pin the browser to one output. Find the output name with
+# `wayland-info` inside the kiosk session (or `loginctl` / journal).
+#[mirror-monitor]
+#match-class=org.mozilla.*
+#set-fullscreen=true
+#set-on-monitor=eDP-1
+#lock-on-monitor=true